FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-3525

This CVE name corresponds to:

Entered	Topic
2012-08-23	jabberd -- domain spoofing in server dialback protocol

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-3525 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-3525
Phase	Assigned(20120614)

Description

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

References

Source	Reference
MLIST	[jabberd2] 20120821 Fwd: [Security] Vulnerability in XMPP Server Dialback Implementations
MLIST	[oss-security] 20120822 CVE Request -- jabberd2: Prone to unsolicited XMPP Dialback attacks
MLIST	[oss-security] 20120822 Re: CVE Request -- jabberd2: Prone to unsolicited XMPP Dialback attacks
MISC	http://xmpp.org/resources/security-notices/server-dialback/
MISC	https://bugzilla.redhat.com/show_bug.cgi?id=850872
CONFIRM	https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
APPLE	APPLE-SA-2013-03-14-1
REDHAT	RHSA-2012:1538
REDHAT	RHSA-2012:1539
BID	55167
SECUNIA	50124
SECUNIA	50859